In late October 2021, the Russian-linked ransomware group Grief claimed it had breached the National Rifle Association and, on October 27, published 13 documents while demanding an undisclosed ransom. The NRA did not confirm the intrusion, but an anonymous source told the Associated Press that its email system had experienced problems during the preceding week. The released material reportedly included NRA board minutes and grant records, including a late-2019 $267,000 application from the Independence Institute that allocated $248,500 to David Kopel’s salary. The Trace noted that Kopel had repeatedly filed court briefs supporting the NRA without disclosing a financial connection to the organization.
On November 10 and 11, Grief posted additional files allegedly containing bank-account information, Social Security numbers, and employees’ home addresses. The Reload said six current and former NRA officials authenticated the documents, including an employee whose personal information was exposed. Threat analysts Brett Callow and Allan Liska described the leak and the organization’s legal and operational distractions as possible factors, but the extent of the compromise and whether a ransom was paid remained unknown. Security experts linked Grief to sanctioned Russian cybercrime group Evil Corp, meaning any ransom payment could have required U.S. Treasury authorization; no public enforcement action or confirmed payment was reported.
